@coffre/db 0.8.2 → 0.10.0

package/dist/connect.d.ts

@@ -1,4 +1,4 @@
-import { t as Database } from "./database-BEnexh-3.js";
+import { t as Database } from "./database-BFnO2b2P.js";
 import { Engine } from "./dialect.js";
 import { ClientConfig } from "pg";
 //#region src/postgres.d.ts

package/dist/{database-BEnexh-3.d.ts → database-BFnO2b2P.d.ts}

@@ -1,4 +1,4 @@
-import { m as schema_d_exports } from "./schema-BZRkBJQZ.js";
+import { m as schema_d_exports } from "./schema-NBVA9q-s.js";
 import { Table } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import pg from "pg";

package/dist/dialect.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-BEnexh-3.js";
+import { i as Queryable } from "./database-BFnO2b2P.js";
 import { SQL, SQLWrapper } from "drizzle-orm";
 import { PgTable } from "drizzle-orm/pg-core";
 //#region src/dialect.d.ts

package/dist/grants.d.ts

@@ -1,7 +1,7 @@
-import { i as Queryable } from "./database-BEnexh-3.js";
+import { i as Queryable } from "./database-BFnO2b2P.js";
 import { Authenticity, Newest } from "./log.js";
-import { Conversion, ConversionInput, InstanceRole, Scope } from "@coffre/core/access";
 import { StoredEntry } from "@coffre/core/audit";
+import { Conversion, ConversionInput, InstanceRole, Scope } from "@coffre/core/access";
 //#region src/grants.d.ts
 /**
  * One grant, as `vault_grants` holds it: on a project (`environmentId`

package/dist/hyperdrive.d.ts

@@ -1,4 +1,4 @@
-import { n as PoolLike } from "./database-BEnexh-3.js";
+import { n as PoolLike } from "./database-BFnO2b2P.js";
 import pg from "pg";
 //#region src/hyperdrive.d.ts
 /** Postgres through a Hyperdrive binding: `postgres(env.HYPERDRIVE)`. */

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { m as schema_d_exports } from "./schema-BZRkBJQZ.js";
-import { a as Transaction, c as tablesOf, i as Queryable, n as PoolLike, o as createDatabase, r as QueryOutsideTransaction, s as own, t as Database } from "./database-BEnexh-3.js";
+import { m as schema_d_exports } from "./schema-NBVA9q-s.js";
+import { a as Transaction, c as tablesOf, i as Queryable, n as PoolLike, o as createDatabase, r as QueryOutsideTransaction, s as own, t as Database } from "./database-BFnO2b2P.js";
 export { Database, PoolLike, QueryOutsideTransaction, Queryable, Transaction, createDatabase, own, schema_d_exports as schema, tablesOf };

package/dist/log.d.ts

@@ -1,4 +1,4 @@
-import { a as Transaction, i as Queryable } from "./database-BEnexh-3.js";
+import { a as Transaction, i as Queryable } from "./database-BFnO2b2P.js";
 import { SQL } from "drizzle-orm";
 import { LogKey, StoredEntry } from "@coffre/core/audit";
 //#region src/log.d.ts
@@ -473,6 +473,12 @@ export type Authenticity = {
 };
 /** Up to `limit` of the entries in the vault's name, allowed, of one `action`, before `before` (the newest when undefined), newest first. */
 export declare function newestVaultEntries(db: Queryable, action: string, limit: number, before?: bigint): Promise<StoredEntry[]>;
+/**
+ * The number of the newest entry in the vault's name, allowed, of one
+ * `action`, or null for none: whether one was appended since, and nothing
+ * of what it says, so its MAC is not checked. One indexed read.
+ */
+export declare function newestVaultSeq(db: Queryable, action: string): Promise<bigint | null>;
 /** How many entries in its name the vault reads back, a page at a time, for its own newest of a kind (`newestAuthentic`). */
 export declare const LOOK_BACK: {
   page: number;

package/dist/log.js

@@ -203,6 +203,16 @@ async function newestVaultEntries(db, action, limit, before) {
 	const { auditLog } = tablesOf(db);
 	return await db.select(entryColumns(db)).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.action, action), eq(auditLog.decision, "allow"), before === void 0 ? void 0 : lt(auditLog.seq, before))).orderBy(desc(auditLog.seq)).limit(limit);
 }
+/**
+* The number of the newest entry in the vault's name, allowed, of one
+* `action`, or null for none: whether one was appended since, and nothing
+* of what it says, so its MAC is not checked. One indexed read.
+*/
+async function newestVaultSeq(db, action) {
+	const { auditLog } = tablesOf(db);
+	const [row] = await db.select({ seq: auditLog.seq }).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.action, action), eq(auditLog.decision, "allow"))).orderBy(desc(auditLog.seq)).limit(1);
+	return row?.seq ?? null;
+}
 /** How many entries in its name the vault reads back, a page at a time, for its own newest of a kind (`newestAuthentic`). */
 const LOOK_BACK = {
 	page: 32,
@@ -229,4 +239,4 @@ async function newestAuthentic(page, check) {
 	return "unreached";
 }
 //#endregion
-export { BATCH_BYTES, LOOK_BACK, LogHeadMismatch, LogRewound, appendEntries, entryColumns, forgetLogHeads, lockLogHead, newestAuthentic, newestVaultEntries, withinBytes };
+export { BATCH_BYTES, LOOK_BACK, LogHeadMismatch, LogRewound, appendEntries, entryColumns, forgetLogHeads, lockLogHead, newestAuthentic, newestVaultEntries, newestVaultSeq, withinBytes };

package/dist/migrations/postgres/0010_handle_places.sql

@@ -0,0 +1,2 @@
+-- A handle's places (0.9): the environments it was made for, by id and whether as @me, which the proxy's stable URL resolves to. A nullable column the release before neither reads nor writes; the app sets it when it makes a handle, and never after (no UPDATE grant).
+ALTER TABLE "credentials" ADD COLUMN "places" text;

package/dist/migrations/postgres/0011_plain_values.sql

@@ -0,0 +1,19 @@
+-- Plain values (0.9): a version of a key marked not secret holds its value in the clear too. Nullable, so the release before writes on as it did.
+ALTER TABLE "secret_versions" ADD COLUMN "plaintext" text;--> statement-breakpoint
+-- A version is still only ever erased, and an erased one holds no value, in the clear or not.
+CREATE OR REPLACE FUNCTION secret_versions_erase_only() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+    IF octet_length(NEW.ciphertext) <> 0 OR octet_length(NEW.wrapped_dek) <> 0 OR NEW.plaintext IS NOT NULL
+       OR (NEW.id, NEW.secret_id, NEW.version, NEW.envelope_version, NEW.iv, NEW.auth_tag,
+           NEW.kek_provider, NEW.kek_id, NEW.kek_version, NEW.created_at, NEW.created_by,
+           NEW.recipe, NEW.pair_id, NEW.pair_half)
+          IS DISTINCT FROM
+          (OLD.id, OLD.secret_id, OLD.version, OLD.envelope_version, OLD.iv, OLD.auth_tag,
+           OLD.kek_provider, OLD.kek_id, OLD.kek_version, OLD.created_at, OLD.created_by,
+           OLD.recipe, OLD.pair_id, OLD.pair_half) THEN
+        RAISE EXCEPTION 'a secret version is only ever erased' USING ERRCODE = 'insufficient_privilege';
+    END IF;
+    RETURN NEW;
+END
+$$;--> statement-breakpoint
+GRANT UPDATE (plaintext) ON secret_versions TO coffre_app;

package/dist/migrations/postgres/0012_sensitive_values.sql

@@ -0,0 +1,18 @@
+-- Sensitive values (0.10): a version never handed back to a person, which the vault's wrap of its data key binds. Defaults to false, so the release before writes on as it did.
+ALTER TABLE "secret_versions" ADD COLUMN "sensitive" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+-- A version is still only ever erased: its sensitivity with the rest of it.
+CREATE OR REPLACE FUNCTION secret_versions_erase_only() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+    IF octet_length(NEW.ciphertext) <> 0 OR octet_length(NEW.wrapped_dek) <> 0 OR NEW.plaintext IS NOT NULL
+       OR (NEW.id, NEW.secret_id, NEW.version, NEW.envelope_version, NEW.iv, NEW.auth_tag,
+           NEW.kek_provider, NEW.kek_id, NEW.kek_version, NEW.created_at, NEW.created_by,
+           NEW.recipe, NEW.pair_id, NEW.pair_half, NEW.sensitive)
+          IS DISTINCT FROM
+          (OLD.id, OLD.secret_id, OLD.version, OLD.envelope_version, OLD.iv, OLD.auth_tag,
+           OLD.kek_provider, OLD.kek_id, OLD.kek_version, OLD.created_at, OLD.created_by,
+           OLD.recipe, OLD.pair_id, OLD.pair_half, OLD.sensitive) THEN
+        RAISE EXCEPTION 'a secret version is only ever erased' USING ERRCODE = 'insufficient_privilege';
+    END IF;
+    RETURN NEW;
+END
+$$;

package/dist/migrations/postgres/0013_contributor_role.sql

@@ -0,0 +1,5 @@
+-- The Contributor role (0.10): use and write, never read. The role checks widen to it, which the release before never grants.
+ALTER TABLE "vault_grants" DROP CONSTRAINT "vault_grants_role_check";--> statement-breakpoint
+ALTER TABLE "vault_grants" DROP CONSTRAINT "vault_grants_environment_role_check";--> statement-breakpoint
+ALTER TABLE "vault_grants" ADD CONSTRAINT "vault_grants_role_check" CHECK ("vault_grants"."role" IN ('viewer', 'contributor', 'developer', 'maintainer', 'access-manager', 'auditor', 'owner'));--> statement-breakpoint
+ALTER TABLE "vault_grants" ADD CONSTRAINT "vault_grants_environment_role_check" CHECK (("vault_grants"."environment_id" IS NULL AND "vault_grants"."environment_slug" IS NULL) OR "vault_grants"."role" IN ('viewer', 'contributor', 'developer', 'auditor'));

package/dist/migrations/postgres/0014_custom_roles.sql

@@ -0,0 +1,4 @@
+-- Roles an Owner makes (0.10): a grant names a role by its id, which the vault's policy defines; which of them an environment may be granted, the vault decides. The checks widen: the release before grants only the roles it ships.
+ALTER TABLE "vault_grants" DROP CONSTRAINT "vault_grants_environment_role_check";--> statement-breakpoint
+ALTER TABLE "vault_grants" DROP CONSTRAINT "vault_grants_role_check";--> statement-breakpoint
+ALTER TABLE "vault_grants" ADD CONSTRAINT "vault_grants_role_check" CHECK ("vault_grants"."role" ~ '^[a-z][a-z0-9-]{1,31}$');